Debloating the Go Color 7, Go 10.3, and Page 7, step by step

debloat_onyx_go_color_7.md

This guide will help you root, de-bloat and secure these amazing Android-based BOOX eReaders from ONYX:

• BOOX Page 7
• Boox Go Color 7 (Gen I)
• Boox Go 7 (Gen II)

The guide assumes that you are using a Mac with Homebrew installed and have just unboxed the device and are turning it on for the first time. (Congrats!)

Why?

• You're concerned about the amount of data this device sends to .cn servers.
• You want a lean and mean eReader a la Kindle.
• You're bored and need something fun to do!

Steps

• DO NOT CONNECT THE DEVICE TO WI-FI
• Complete onboarding setup
• Enable USB Debugging
• Root the device
• Install AFWall+ and AdAway
• Remove unnecessary apps
• Sideload wanted apps and whitelist them
• Harden the device
• Use and enjoy!
• Credits

DO NOT CONNECT THE DEVICE TO WIFI!

These devices are very chatty with Onyx servers in .cn. Not much is known about what they are sending. Err on the side of paranoia caution and keep the eReader offline until we're done.

Complete onboarding setup

Complete the First Time wizard after powering on the device. Don't bother reading the Privacy Policy; it's bunk. Accept the agreements, and select any time zone. We will change that later.

Enable USB Debugging

1. "Apps" -> Hamburger Menu -> "App Management" -> "USB Debug Mode"
2. Connect the device via USB.
3. Tap "OK" on the device, then click "Allow" on your Mac.

Helpful Screenshots

Root the device

Drop into EDL

1. Install adb: brew install android-platform-tools
2. Confirm the device shows up; should not be blank: adb devices
3. Determine the boot slot that your device is using; will be _a or _b: adb shell getprop ro.boot.slot_suffix
4. Reboot into Emergency Download Mode: adb reboot edl

Decrypt and extract boot images

Go 7 Gen II

✅ Courtesy of @doomgoatman over at MobileRead. Original post. Thanks!

NOTE: These instructions theoretically work with a BOOX Go Color 7 Gen II, but they haven't been tested against it.

✅ I was able to perform the steps below without an EDL cable. Your mileage may vary!

Decrypt Boox firwmare and extract boot and data partitions

1. Download the latest (at this time of writing) FairPhone FP4 /e/OS Android 14 images: curl -Lo fp4.zip https://images.ecloud.global/official/FP4/IMG-e-4.0-a14-20260610633982-official-FP4.zip && unzip fp4.zip
2. Download the recovery image: curl -Lo ./misc-recovery.img https://www.mobileread.com/forums/attachment.php?s=1a0597ae2ac65b1fbcc7f0c14e100aef&attachmentid=221178&d=1771657615
3. Download the latest update for Boox Go 7: curl 'http://en-data.onyx-international.cn/api/firmware/update?where=\{%22buildNumber%22:0,%22buildType%22:%22user%22,%22deviceMAC%22:%22%22,%22lang%22:%22en_US%22,%22model%22:%22Go7%22,%22submodel%22:%22%22,%22fingerprint%22:%22%22\}' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko)' |jq -r .downloadUrlList[0] | xargs curl -Lo ./update.upx
4. Get the Boox Update Decrypter:

git clone https://github.com/Hagb/decryptBooxUpdateUpx.git
cd decryptBooxUpdateUpx
git submodule update --init --recursive

5. Install the Payload Dumper tool: brew install payload-dumper-go
6. Decrypt the update: python3 DeBooxUpx.py Go7 ../update.upx ../update.zip
7. Extract partitions: payload-dumper-go -o stock_images payload.bin
8. Install the edl utility: here
9. Ensure that you are still in the edl directory: pwd
10. Get the loader for this device: curl -Lo ./go7_loader.bin https://github.com/bkerler/Loaders/raw/refs/heads/main/lenovo_motorola/0000000000000000_bdaf51b59ba21d8a_fhprg.bin

Overwrite partitions

11. Download and extract the unlocked fastboot/recovery image:

curl -Lo ./frp.zip https://github.com/user-attachments/files/24603170/frp_oemunlock.zip
unzip ./frp.zip

12. Backup partitions:

python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc r abl_a abl_a_backup.img
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc r abl_b abl_b_backup.img
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc r frp frp_backup.img
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc r devinfo devinfo_backup.img
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc r boot_a boot_a_backup.img
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc r boot_b boot_b_backup.img

12. Overwrite boot partitions:

python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc w boot_a stock_images/boot.img
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc w boot_b stock_images/boot.img

13. Overwrite other partitions:

# Stock boot to both slots
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc w boot_a stock_images/boot.img
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc w boot_b stock_images/boot.img

# FairPhone 4 ABL to both slots
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc w abl_a fp4/abl.img
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc w abl_b fp4/abl.img

# Unlocked fastboot/recovery
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc w frp frp_oemunlock.img

# Stock recovery to both slots
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc w recovery_a stock_images/recovery.img
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc w recovery_b stock_images/recovery.img

# Misc-recovery to trigger recovery boot
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc w misc misc-recovery.img

# Erase devinfo (required for unlock to take effect)
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc e devinfo

14. Reset the device: python3 ./edl/edl.py --loader=go7_loader.bin reset

Go Color 7/10 Gen 1, Go Page 7

NOTE: Steps 3, 4 and 5 can be skipped if you're rooting a Page 7.

1. Install the edl utility: here

2. Ensure that you are still in the edl directory: pwd

3. Retrieve the EDL loader for this device: curl -Lo ./loader.zip https://github.com/user-attachments/files/16236986/sm6225.zip (Go here if this link 404s).

   NOTE: Skip this step if you're rooting at Page 7.

4. Unzip the loader: unzip ./loader.zip

   NOTE: Skip this step if you're rooting at Page 7.

5. Confirm the loader's checksum matches the below:

   $: md5sum ./sm6225.bin
   ee47e72f618563ed1555feff9ba95db6  ./sm6225.bin

   NOTE: Skip this step if you're rooting at Page 7.

6. Extract the boot partition, replace _a with _b depending on step 3 from the last section: edl --loader=sm6225.bin r boot_a boot.img (WARNING: This will fail if you try to run edl --loader=sm6225.bin without any commands first. You must do this in one go. Otherwise, you will get USB timeouts. If this happens, long press the power button to restart the device.)

   NOTE: Omit the --loader argument if you're rooting a Page 7.

7. Reboot the device; might need to run this twice: edl --loader=sm6225.bin reset --resetmode=reset

   NOTE: Omit the --loader argument if you're rooting a Page 7.

8. Push the boot image to the device: adb push boot.img /sdcard/Download/boot.img

Turn off App Freezing

1. Go to the home screen. Tap on "Apps" then on the snowflake.
2. Set all toggles to "OFF".

Root boot image with Magisk

📝 NOTE: Magisk will NOT open if you are running a Go 7 Gen II. However, you should still be able to approve superuser requests.

1. Install Magisk: curl -Lo magisk.apk https://github.com/topjohnwu/Magisk/releases/download/v28.0/Magisk-v28.0.apk ; adb install magisk.apk

2. Open Magisk on the device; click Install; click Select and Patch a File; select boot.img; click "Let's Go"; take note of the newly-created boot image.

3. Retrieve the patched boot image: adb pull /sdcard/Download/magisk_patched-28000-[ID].img ./boot-patched.img

4. Re-enter EDL: adb reboot edl

5. Write the patched boot image: edl --loader=sm6225.bin w boot_a boot-patched.img # or boot_a depending on step 3 (WARNING: Same warning above applies here.)

   NOTE: Omit the --loader argument if you're rooting a Page 7.

6. Reboot the device; might need to run this twice: edl --loader=sm6225.bin reset --resetmode=reset

   NOTE: Omit the --loader argument if you're rooting a Page 7.

Install AFWall and AdAway

AFWall

AFWall uses iptables to grant or deny Internet access to all applications on your tablet.

1. curl -Lo afwall.apk https://github.com/ukanth/afwall/releases/download/v3.6.0/AFWall_3.6.0_Free.apk

2. Install it: adb install afwall.apk

3. Open AFWall+ on the device and grant it superuser access.

4. Check all three boxes next to apps that should have internet access.

5. Run the commands below to avoid "Connected, but no Internet" errors upon connecting to Wi-Fi access points (see also)

    adb shell settings put global captive_portal_mode 0
    adb shell settings put global_captive_portal_detection_enabled 0
    adb shell settings put global wifi_watchdog_on 0
    adb shell settings put global captive_portal_detection_enabled 0
    adb shell settings put global wifi_watchdog_background_check_enabled 0
    adb shell settings put global captive_portal_server httpstat.us
    adb shell settings put global captive_portal_https_server "https://httpstat.us/204"

AdAway

AdAway is a /etc/hosts based DNS blocking solution. No DNS workarounds!

1. curl -Lo adaway.apk https://github.com/AdAway/AdAway/releases/download/v6.1.4/AdAway-6.1.4-20241027.apk && adb install adaway.apk
2. Enable AdAway in AFWall+.

Remove unneccessary apps

1. adb shell
2. Run the command below:

pm uninstall --user 0 com.android.bips
pm uninstall --user 0 com.android.bluetoothmidiservice
pm uninstall --user 0 com.android.cameraextensions
pm uninstall --user 0 com.android.cts.ctsshim
pm uninstall --user 0 com.android.dreams.phototable
pm uninstall --user 0 com.android.emergency
pm uninstall --user 0 com.android.internal.display.cutout.emulation.corner
pm uninstall --user 0 com.android.internal.display.cutout.emulation.double
pm uninstall --user 0 com.android.internal.display.cutout.emulation.hole
pm uninstall --user 0 com.android.internal.display.cutout.emulation.tall
pm uninstall --user 0 com.android.internal.display.cutout.emulation.waterfall
pm uninstall --user 0 com.android.internal.systemui.navbar.gestural
pm uninstall --user 0 com.android.internal.systemui.navbar.gestural_extra_wide_back
pm uninstall --user 0 com.android.internal.systemui.navbar.gestural_narrow_back
pm uninstall --user 0 com.android.internal.systemui.navbar.gestural_wide_back
pm uninstall --user 0 com.android.internal.systemui.navbar.threebutton
pm uninstall --user 0 com.android.printservice.recommendation
pm uninstall --user 0 com.android.providers.blockednumber
pm uninstall --user 0 com.android.providers.contacts
pm uninstall --user 0 com.android.quicksearchbox
pm uninstall --user 0 com.android.smspush
pm uninstall --user 0 com.android.theme.font.notoserifsource
pm uninstall --user 0 com.android.vending
pm uninstall --user 0 com.google.android.apps.restore
pm uninstall --user 0 com.google.android.gms.location.history
pm uninstall --user 0 com.google.android.overlay.gmsconfig.common
pm uninstall --user 0 com.google.android.syncadapters.calendar
pm uninstall --user 0 com.google.android.syncadapters.contacts
pm uninstall --user 0 com.onyx.aiassistant #AI Assistant app
pm uninstall --user 0 com.onyx.android.production.test #Test feature
pm uninstall --user 0 com.onyx.appmarket # Appmarket app
pm uninstall --user 0 com.onyx.calculator # Calculator app
pm uninstall --user 0 com.onyx.clock # Clock app
pm uninstall --user 0 com.onyx.dict # Dict app
pm uninstall --user 0 com.onyx.easytransfer # Easytransfer app
pm uninstall --user 0 com.onyx.gallery # Gallery app
pm uninstall --user 0 com.onyx.kime # Kime app
pm uninstall --user 0 com.onyx.latinime # Keyboard app, removing it will leave you with the Google Speech-to-text keyboard 
pm uninstall --user 0 com.onyx.mail # Mail app
pm uninstall --user 0 com.onyx.musicplayer # Music player
pm uninstall --user 0 com.onyx.voicerecorder # Voice Recorder
pm uninstall --user 0 com.qualcomm.embms
pm uninstall --user 0 com.qualcomm.qti.seccamservice
pm uninstall --user 0 com.qualcomm.qti.server.qtiwifi
pm uninstall --user 0 com.qualcomm.qti.services.systemhelper
pm uninstall --user 0 com.qualcomm.qti.uim
pm uninstall --user 0 com.qualcomm.qti.uimGbaApp
pm uninstall --user 0 com.qualcomm.qti.xrcb
pm uninstall --user 0 com.qualcomm.qti.xrvd.service
pm uninstall --user 0 com.qualcomm.qtil.aptxui
pm uninstall --user 0 org.chromium.chrome # Chrome browser

NOTE: This will not remove the default Onyx launcher, as it is required for configuring the device.

Sideload apps

Download the apps that you want to install either on APKMirror or F-Droid. Always verify those checksums!

Harden the device

1. Change NTP servers: adb shell settings put global ntp_server pool.ntp.org; adb shell settings put global ntp_server_2 en.pool.ntp.org
2. Change captive portal endpoints:

adb shell settings put global captive_portal_http_url "http://connectivitycheck.android.com/generate_204"
adb shell settings put global captive_portal_https_url "https://connectivitycheck.android.com/generate_204"
adb shell settings put global captive_portal_fallback_url "http://connectivitycheck.gstatic.com/generate_204"

3. Revisit your AFWall configuration and ensure that the apps you want whitelisted are whitelisted.

Use and enjoy!

You're finally ready to connect your eReader to the world! Enjoy!

Credits

• MobileRead: Help me root the Go Color 7. link
• MobileRead: Help me root the Go Color 10.3. link
• @RenateUSB: THANK YOU for extracting the Qualcomm EDL loaders for these devices. link
• Debloating the Onyx Boox Go 10.3: Thanks for the list of apps that can be removed and the firewall suggestion. link

Optional Stuff

Migrating from one Boox to another locally

• Download Swift Backup from here and install it to the source and target tablets.
• On the source device, open Swift Backup, then tap "Continue without an account" twice. On the home screen, scroll down to "Backup all apps." Follow the instructions.
• Connect to the source device via adb and pull the entire SwiftBackup folder: adb pull /sdcard/SwiftBackup
• Connect to the target device via adb and push the entire SwiftBackup folder: adb push ./SwiftBackup /sdcard
• Open Swift Backup on the target device. Tap "Continue without an account" twice. On the home screen, tap "Restore all apps." Follow the instructions.

In step 12, is the partition writing to meant to be the same one you got the boot id from, or the one you didn't?

@BeeFox-sys: Thanks for reading my guide. No; you'll want to flash the opposite boot partition. This way, you have the original ROM still available in case something goes wrong with your rooted install. (That said, it's been a while since I wrote this, and I haven't run into any issues with my device.)

I love your guide @carlosonunez
I find myself coming back to it every time.

I have just one issue, as @BeeFox-sys mentioned, you're writing patched img to the_b partition, but device still boots from the _a partition.
After I write the _b partition, nothing happens. I have to overwrite _a partition for root to work, which is logical.

Maybe you forgot to mention switching to the _b partition?

Hello, very interesting to read and debloat our gadgets.
Do we have any Linux version of the debloating/rooting method?

same tools are on linux/mac

Thanks @Jurrer
I will try it out on Ubuntu.

Hello, Are there any changes necessary for Black And White version?
Thank you for this guide

Should be the same, though I don't have that version of the device to test this on.

…

On May 14, 2026, at 17:36, David Kubeša ***@***.***> wrote: @Kobtul commented on this gist. Are there any changes necessary for Black And White version? — Reply to this email directly, view it on GitHub <https://gist.github.com/carlosonunez/a0ec3f02576867329bc313bae889563d#gistcomment-6150690> or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADGWPR7JJVY2TXKCGWVEAYL42ZC55BFKMF2HI4TJMJ2XIZLTSOBKK5TBNR2WLJZSGU3DGNRYHCSG4YLNMWUGCY3UN5ZF62LEQKSXMYLMOVS2I5DSOVS2I3TBNVS3W5DIOJSWCZC7OBQXE5DJMNUXAYLOORPWCY3UNF3GS5DZQKSXMYLMOVS2IZ3JON2KI3TBNVS2W5DIOJSWCZC7OR4XAZNMON2WE2TFMN2F65DZOBS2WR3JON2EG33NNVSW45FGORXXA2LDOOIYFJDUPFYGLJDHNFZXJJLWMFWHKZNJGEZTGMZYGYYTANNHORZGSZ3HMVZKMY3SMVQXIZI>. You are receiving this email because you authored the thread. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

I was not able to dump boot.img with the loader provided on the b/w Go 7, however I found that the SM_BITRA loader worked: https://www.temblast.com/ref/onyxldr.htm

Edit: I had no issues booting after overwriting boot_b, however Magisk didn't show as functional so I overwrote boot_a. Now I'm stuck in fastboot with a locked bootloader, probably because I neglected to unlock it before performing the rooting process. Can't get into recovery either. Need to purchase a EDL cable to get myself out of this mess.

See this thread if you get stuck in locked fastboot, like me: https://www.mobileread.com/forums/showthread.php?s=31ea2504dce601048694a23e2c22d9fc&t=372058&page=4

In step 12, is the partition writing to meant to be the same one you got the boot id from, or the one you didn't?

My apologies; you should write to the same device you pulled from. So write to boot_a instead of boot_b. (I've updated the guide.)

See this thread if you get stuck in locked fastboot, like me: https://www.mobileread.com/forums/showthread.php?s=31ea2504dce601048694a23e2c22d9fc&t=372058&page=4

Thanks for posting this. This guide still works for Gen 1 devices that didn't update to the latest firmware. (I just performed this guide on a Page 7, though, interestingly, it's running firmware built this year.)

Hello there and thanks first of all for the amazing guide

I am sadly stuck on
python3 ./edl/edl.py --loader=go7_loader.bin --memory=emmc w frp frp_oemunlock.img
since there is no file like:
frp_oemunlock.img

Where would I get this from?

Thanks a lot in advance :)

Sorry! Updated. See step 11.